I believe you could do relaying like this, if suitably determined. You would need to do it in near real-time, and no doubt the endpoint giving PATs will be rate-limited.

At some point the amount of manual effort to automate this (do you have an API to retrieve the token programmatically from another app?) will exceed what it is worth to avoid a captcha!

I suspect you will find it is hard to gwt the real response out from the trusted browser.